Cybersecurity Checklist for Nonprofits: Complete Guide
The Complete Cybersecurity Checklist for Nonprofits
Nonprofits manage more sensitive information than many people realize.
Think about everything your organization handles: donor names and contact information, employee records, volunteer details, financial documents, payment information, program data, confidential emails, cloud files, and sometimes information about vulnerable individuals or communities.
For cybercriminals, that information can make a nonprofit an attractive target.
At the same time, many nonprofits operate with limited budgets, small teams, volunteers, aging computers, and little or no dedicated IT staff. That makes creating a practical cybersecurity checklist for nonprofits especially important.
The good news is that improving nonprofit cybersecurity doesn't have to mean buying expensive technology. Start with the areas that create the greatest risk and build from there.
Here are nine essential areas every nonprofit should review.
1. Enable Multi-Factor Authentication
Your first priority should be multi-factor authentication (MFA).
MFA requires an additional verification method beyond a password before someone can access an account. If a password is stolen through phishing or another attack, that additional step can help prevent unauthorized access.
Cybersecurity and Infrastructure Security Agency reports that using MFA makes users 99% less likely to be hacked.
At minimum, enable MFA for:
Email accounts
Financial systems
Donor management platforms and CRMs
Cloud storage
Administrator accounts
Remote-access tools
Start with administrators and accounts containing sensitive information, then expand MFA across your organization.
2. Use Strong, Unique Passwords
Reusing passwords is still a major security risk.
If someone uses the same password for several platforms and one service is compromised, attackers may try those credentials on email, cloud storage, financial systems, or other applications.
Every staff member and volunteer should have their own account whenever possible.
Use a reputable password manager to create and securely store unique passwords rather than storing credentials in spreadsheets, shared documents, sticky notes, or email.
And avoid shared logins for critical systems.
3. Train Your Staff and Volunteers
Technology alone cannot prevent every cyberattack.
A convincing phishing email can look like it came from an executive director, coworker, vendor, board member, or even a trusted organization.
Your nonprofit cybersecurity plan should therefore include regular security awareness training.
Teach staff and volunteers how to recognize:
Phishing emails
Fake login pages
Suspicious attachments
Unexpected password reset requests
Fraudulent payment requests
Social engineering
Unusual MFA prompts
Training should be ongoing rather than treated as a once-a-year exercise.
Create a simple process for reporting suspicious emails so people know exactly what to do when something doesn't look right.
4. Keep Computers and Software Updated
Outdated software can leave known security vulnerabilities open to attackers.
Enable automatic updates wherever possible for:
Windows and macOS
Web browsers
Microsoft 365 applications
Mobile devices
Third-party applications
Security software
Your nonprofit should also inventory older computers and identify devices that can no longer receive security updates.
The goal isn't necessarily to replace every older computer immediately. It's to understand which devices create the greatest risk and develop a reasonable refresh plan.
5. Protect Every Endpoint
Every laptop, desktop, or other device connecting to organizational information represents a potential entry point.
Traditional antivirus is useful, but modern organizations should consider endpoint protection or endpoint detection and response (EDR) to identify suspicious activity, malware, ransomware, and other threats.
Don't forget devices used by remote employees or volunteers.
If personal devices are allowed, establish a clear bring-your-own-device (BYOD) policy defining minimum security requirements.
6. Back Up Critical Nonprofit Data
Imagine opening your computer tomorrow and discovering that donor records, financial documents, program files, or shared folders have disappeared.
Would your organization be able to recover them?
Secure backups are an essential part of ransomware protection for nonprofits.
Identify your most important information and systems, maintain protected backups, and periodically test whether those backups can actually be restored.
A backup that has never been tested shouldn't automatically be assumed to be recoverable.
7. Restrict Access to Sensitive Information
Not everyone needs access to everything.
Use the principle of least privilege, meaning users receive only the access they need to perform their responsibilities.
Review access to:
Donor information
HR records
Banking and accounting platforms
Payroll information
Shared cloud folders
Administrative accounts
Confidential program information
Access should also be removed promptly when an employee, contractor, or volunteer leaves the organization.
Regular access reviews can uncover old accounts and unnecessary permissions before they become security problems.
8. Create an Incident Response Plan
Even strong cybersecurity controls cannot eliminate every risk.
Your nonprofit needs to know what happens when something goes wrong.
Create a simple incident response plan explaining:
Who should be contacted first
Who makes decisions during an incident
How compromised accounts should be handled
How systems can be isolated
Where backups are located
Who contacts your IT provider
How staff communicate if email becomes unavailable
When insurance, legal counsel or appropriate authorities should be contacted
Don't leave this document untouched in a folder. Review and test it periodically.
A simple plan everyone understands is much more useful than an elaborate plan nobody knows exists.
9. Conduct Regular Cybersecurity Risk Assessments
Cybersecurity isn't a one-time project.
Technology changes. Employees leave. New staff members arrive. Organizations adopt new cloud applications, collect different information, and replace devices.
Regular cybersecurity risk assessments for nonprofits help identify where your biggest vulnerabilities currently exist.
Review areas such as:
User accounts
MFA coverage
Administrator privileges
Password practices
Endpoint protection
Software updates
Backups
Email security
Cloud sharing permissions
Employee and volunteer training
Incident response
Unsupported hardware and software
A structured checklist can also help your nonprofit prioritize cybersecurity spending rather than trying to fix everything at once.
Your Nonprofit Cybersecurity Checklist
Use this quick checklist with your team:
MFA enabled for email and critical applications
Unique passwords stored in a password manager
Regular cybersecurity awareness training
Automatic operating system and software updates
Endpoint protection on every organizational computer
Secure backups of important data
Backups regularly tested for recovery
Sensitive files restricted to appropriate users
Former staff and volunteer accounts removed promptly
Documented incident response plan
Regular cybersecurity vulnerability and risk assessments
These controls align with widely recommended cybersecurity practices. CISA, for example, provides organizational checklists designed to help organizations prioritize and track cybersecurity protections.
Cybersecurity Doesn't Have to Be Overwhelming
For nonprofits with limited IT resources, cybersecurity can feel like an endless list of expensive products and complicated policies.
It doesn't have to be.
Start with the risks that can have the greatest impact: email accounts, passwords, MFA, outdated computers, backups, administrative access, shared files, and employee awareness.
Then build a longer-term cybersecurity plan around your organization's actual risks, budget, staff, and mission.
Heartfelt IT specifically works with nonprofits and purpose-driven organizations, providing technology assessments, planning, cloud computing, consulting and IT support designed around the resource challenges nonprofits face.
Ready to Find Your Biggest Cybersecurity Risks?
Not sure where your biggest vulnerabilities are?
Book a consultation with Heartfelt IT to review your organization's technology and create a practical cybersecurity plan that fits your team, budget, and mission.
